But many Analytics account owners simply want to know: Can I use Google Analytics and be GDPR compliant? The answer to that question is:

“Yes, but only if you change this one setting...”

The standard version of the Google Analytics tracking code temporarily collects personal data out of the box, so configuration is required if you want to prevent the collection of personal data in Google Analytics.

In this post, I am going to help you understand what type of personal data you are collecting in Google Analytics, and how you can adjust your tracking code to eliminate personal data collection from your Analytics installation.

Is Google Analytics GDPR compliant out of the box?

The basic Google Analytics tracking setup does not collect very much personal data, and the utility of this data is debatable, but it does record personal information. This data is enough to fall under the rules of GDPR for users located in the EEA.

Advanced Google Analytics installs and personal data

We will not spend too much time talking about advanced GA installs in this article, because if you want to track this data, you should be strongly considering asking for consent from users instead of trying to circumvent the system.

What I want to talk about is that even the standard installations of Google Analytics collect personal data. That collection occurs on each hit your analytics tracking code sends to Google Analytics, and the personal data that you collect is your users’ IP address.

So how do you use Google Analytics without causing GDPR compliance problems?

You can anonymize your users’ IP addresses, which prevents the collection of personal data from your Google Analytics tracking code.

How to anonymize IP addresses in Google Analytics

You can anonymize your users’ IP addresses by adding a function to your analytics tracking code.

Anonymizing IP addresses in gtag.js

It’s important to compare your function syntax against the Google developers example before you add it to your existing tracking code. Verifying your function will help you avoid any syntax errors.

Once you verified you are tracking correctly, you can add this function to your tracking tag, and it will anonymize user IPs at the point of collection.

Anonymizing IP addresses in Universal Analytics

If you’re using universal analytics (i.e., analytics.js), the anonymize function looks like this:

You’ll notice that this function is different from the function for gtag.js. The I in “Ip” is in caps, and there is no underscore. I am not sure why these functions are different. But, these differences can cause some confusion. So, if you’re adding these functions to multiple accounts, make sure you’re using the right syntax for each tracking tag.

Hide IP addresses with Old school ga.js

If you are using ga.js – well, all I have to say is… It might finally be time to update your tracking code.

Ok, maybe it wasn’t your choice to use a tracking tag that’s five years past its prime. In that case, I’m sorry that I’m not sorry for calling you out. Here’s what the anonymize function looks like for ga.js:

If you work for a company that’s still using ga.js, the GDPR fines might be hefty enough provoke your employer to update their tracking.

Inform the decision makers at your company that it will be easier to make GDPR related changes with the newest, shiniest tracking code. Hopefully, that will help you move your company’s tracking capabilities out of the Google Analytics stone age.

Anonymize your IP addresses in your Google Analytics WordPress plugin

What if you use a plugin to manage your Google Analytics tracking code?

The most popular WordPress plugin for Google Analytics is Monsterinsights. You can choose to anonymize user IP addresses inside of your Monsterinsights settings. All you have to do is check the button in your demographic settings to anonymize user IPs.

To anonymize IP addresses in GTM, you need to adjust your Google Analytics Settings variable. Or you can do this directly in your Universal Analytics tag.

In the GA settings variable, change your Fields to Set to “anonymizeIp,” and set your value to “true.”

Note that this is the syntax for Universal Analytics. Making this adjustment in GTM is the equivalent of changing your code in Analytics.js.

What about GA classic served through GTM?

If you are using GTM and GA Classic tags, then I am sad for you. Either you have some master-plan we don’t know about, or your life is filled with sadness.

Concealing user IP addresses and GDPR compliance

Anonymizing IPs in your Google Analytics tracking code eliminates the collection of user data for basic installations. And if you don’t collect any other personal data on your website, I believe that you will have mitigated any GDPR consent issues within your Google Analytics data.

But if you have an advanced Google Analytics installation, you’re going to have to make some choices. You’re either going to have to stop collecting user data or obtain tacking consent.

Do you want to learn more about tracking consent?

A lot of analytics geeks will utilize advanced Google Analytics tracking code installations. In these cases, there’s not one setting you can change to become GDPR compliant. It’s going to take more work than that. It’s probably going to require gathering user consent.

I was thinking about doing an upcoming video and post about how to obtain tracking consent on your website. If you want to see that video, leave a comment below. If we get enough comments, we’ll do a full tutorial on tracking consent.

Of course, even if you have an advanced installation of Google Analytics, you will probably still benefit from concealing your user IPs. But before we make that determination let’s look at the impact of removing IP address data from Google Analytics.

What is the impact of GDPR compliance on your Google Analytics data?

You might be wondering if losing IP data will compromise the accuracy of your reports. Let’s look at how the loss of IP data affects our measurement accuracy.

With the result of this study in mind, let’s talk about our final question.

What will you lose if you eliminate personal data from Google Analytics?

Huiyan’s study showed us that you will lose some accuracy from your city-level reporting data. Your city-level reporting accuracy may even decrease by about 30% for users on desktop or tablet devices.

So what’s my reaction to this? I’ll let the late, great Chris Farley answer that question.

The loss of IP address data is not a significant loss (for me)

I don’t see losing some city-level reporting accuracy as a big deal. Keep in mind your city-level data won’t be entirely inaccurate, it will just be less accurate. So, you’ll still have a good idea of the general city area of your users. But your reports might not be able to identify your user’s specific locations or neighborhoods.

Essentially, the city dots on your Google Analytics reporting map might get a little bigger if you give up your user IP data.

I suppose if you’re doing highly targeted, local market analysis, this data loss could be a cause for concern. And in that case, it’s likely that you are tracking enough data that you will want to consider obtaining tracking consent anyway.

Spoiler alert: IP addresses report the wrong city all the time!

IP addresses commonly misreport your location. I know this because every time I log on to this blog, my dashboard tells me I am in a city 20 miles away from where I am currently located.

That said, Google Analytics seems to have a more accurate IP reporting database than most other platforms. And if you anonymize your IPs, your Google Analytics data will be about 30% less accurate at the city level.

But, the loss of city-level location data is a small price to pay for GDPR compliance.

I’ll leave you with this conclusion and call-to-action:

You should anonymize your IP address data in Google Analytics

If you’re using Google Analytics, you’re collecting IP addresses. By anonymizing IPs addresses, you’re eliminating the collection of personal data from your installation (assuming you have made no other changes to your code).

In a GDPR world, you gain compliance by anonymizing user IP addresses. You don’t lose all that much.

Have questions about Google Analytics and GDPR?

What are your questions about Google Analytics and GDPR compliance? Leave your questions in the comments below. I’ll try to answer as many of your questions as I can.

About Jeff Sauer

Jeff Sauer is an independent Digital Marketing Consultant, Speaker and Teacher based out of a suitcase somewhere in the world. Formerly of Minneapolis, MN and San Francisco, CA.